Commit b6839ef2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 

Pull char/misc fixes from Greg KH:
 "Here are a few small char/misc driver fixes for 4.20-rc5 that resolve
  a number of reported issues.

  The "largest" here is the thunderbolt patch, which resolves an issue
  with NVM upgrade, the smallest being some fsi driver fixes. There's
  also a hyperv bugfix, and the usual binder bugfixes.

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
  thunderbolt: Prevent root port runtime suspend during NVM upgrade
  Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
  binder: fix race that allows malicious free of live buffer
  fsi: fsi-scom.c: Remove duplicate header
  fsi: master-ast-cf: select GENERIC_ALLOCATOR
parents d7aca8a7 6484a677

drivers/android/binder.c

+12 −9
Original line number Diff line number Diff line
@@ -2974,7 +2974,6 @@ static void binder_transaction(struct binder_proc *proc, 
		t->buffer = NULL;

		goto err_binder_alloc_buf_failed;

	}

	t->buffer->allow_user_free = 0;

	t->buffer->debug_id = t->debug_id;

	t->buffer->transaction = t;

	t->buffer->target_node = target_node;
@@ -3510,14 +3509,18 @@ static int binder_thread_write(struct binder_proc *proc, 


			buffer = binder_alloc_prepare_to_free(&proc->alloc,

							      data_ptr);

			if (buffer == NULL) {

				binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",

					proc->pid, thread->pid, (u64)data_ptr);

				break;

			if (IS_ERR_OR_NULL(buffer)) {

				if (PTR_ERR(buffer) == -EPERM) {

					binder_user_error(

						"%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",

						proc->pid, thread->pid,

						(u64)data_ptr);

				} else {

					binder_user_error(

						"%d:%d BC_FREE_BUFFER u%016llx no match\n",

						proc->pid, thread->pid,

						(u64)data_ptr);

				}

			if (!buffer->allow_user_free) {

				binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",

					proc->pid, thread->pid, (u64)data_ptr);

				break;

			}

			binder_debug(BINDER_DEBUG_FREE_BUFFER,

drivers/android/binder_alloc.c

+6 −10
Original line number Diff line number Diff line
@@ -151,16 +151,12 @@ static struct binder_buffer *binder_alloc_prepare_to_free_locked( 
		else {

			/*

			 * Guard against user threads attempting to

			 * free the buffer twice

			 * free the buffer when in use by kernel or

			 * after it's already been freed.

			 */

			if (buffer->free_in_progress) {

				binder_alloc_debug(BINDER_DEBUG_USER_ERROR,

						   "%d:%d FREE_BUFFER u%016llx user freed buffer twice\n",

						   alloc->pid, current->pid,

						   (u64)user_ptr);

				return NULL;

			}

			buffer->free_in_progress = 1;

			if (!buffer->allow_user_free)

				return ERR_PTR(-EPERM);

			buffer->allow_user_free = 0;

			return buffer;

		}

	}
@@ -500,7 +496,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( 


	rb_erase(best_fit, &alloc->free_buffers);

	buffer->free = 0;

	buffer->free_in_progress = 0;

	buffer->allow_user_free = 0;

	binder_insert_allocated_buffer_locked(alloc, buffer);

	binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_alloc_buf size %zd got %pK\n",

drivers/android/binder_alloc.h

+1 −2
Original line number Diff line number Diff line
@@ -50,8 +50,7 @@ struct binder_buffer { 
	unsigned free:1;

	unsigned allow_user_free:1;

	unsigned async_transaction:1;

	unsigned free_in_progress:1;

	unsigned debug_id:28;

	unsigned debug_id:29;



	struct binder_transaction *transaction;

drivers/fsi/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -46,6 +46,7 @@ config FSI_MASTER_AST_CF 
	tristate "FSI master based on Aspeed ColdFire coprocessor"

	depends on GPIOLIB

	depends on GPIO_ASPEED

	select GENERIC_ALLOCATOR

	---help---

	This option enables a FSI master using the AST2400 and AST2500 GPIO

	lines driven by the internal ColdFire coprocessor. This requires

drivers/fsi/fsi-scom.c

+0 −1
Original line number Diff line number Diff line
@@ -20,7 +20,6 @@ 
#include <linux/fs.h>

#include <linux/uaccess.h>

#include <linux/slab.h>

#include <linux/cdev.h>

#include <linux/list.h>



#include <uapi/linux/fsi.h>

CRA Git | Maintained and supported by SUSTech CRA and CCSE